What’s New?

Performance Breakthrough

Features

Impact

Roadmap

Overview

No other vendor talks freely about real limits and product usability…

Secret Transparency

Transparency

VS

Performance is the key! Why?

Sniffer Database User Queries

Architecture Sniffer How fast can we analyze the traffic?

Database How fast can we store and query data?

How fast can we…?

Analyse Store Query

PacketsPer sec.

FlowsPer 2 min.

Seconds

Current Limits in version 3.x

300kPackets per sec.

500kflow analysis / 2 min.

>15 s at 500k flow analysis / 2 min.

Real

Theoretical

v3 Scalability ConstraintsWhen hardware cannot just do it!

Scalability

PV-500 PV-8000

A True Technological Breakthrough!

SnifferV3 vs V4 Performance

Analyze 10G interfaces at full speed with

real life traffic!

x 4

< 300 000 packets / sec.

> 1 200 000 packets / sec.

300 000

1 200 000

packets/sec.

x4

v3 v4

True

Full Speed

v4 Traffic analyzer @ 10GbpsOn average: 4 times faster than the previous version

0

200 000

400 000

600 000

800 000

1 000 000

1 200 000

1 400 000

1 600 000

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 51 53 55 57 59 61 63

Analyzing real traffic at ~10 Gbps

Received packets

Dropped packets

With real traffic!

50

500

Max MiB inserted by minuteDatabaseV3 vs V4 Performance

New database technology

x 10

> 50 MiB inserted / minute

> 500 MiB inserted / minute

x10

v3 v4

120

8

seconds / queryUser QueriesV3 vs V4 Performance

Depends on the queries

Speed increase varies from x10 to x100

15x faster

> 120 seconds / query

< 8 seconds / query

/ 15

v3 v4

Sniffer Database User Queries

x10 x15x4

Faster network analyzer

Faster storage

Faster answers to user queries

A whole range of new opportunities is now open

1

2

3

4

Game Changer

v4 Product Range

Renaming Simplified role-based naming

Poller Capture

Collector Datastore

After

v4 Terminology

Before

v3 Terminology

Master

Traffic Sniffer

Database

User Interface

Datastore

Traffic Sniffer

ListenerCapture

New role naming

Number of flows analyzed is now per minuteImproved

granularity

v3 : updates every two minutes Twice as fast v4 : updates every minute

Number of flow analysisOn average: it is divided by two for the same workload

100 000

flow analysis per minute

200 000

flow analysis per two minuteson average, divided by 2

Freedom on transaction analysis activation

Room for future transaction decoders

Solution updates possibilities

Hardware

Virtual

Mobile

Datacenter

Express

Datacenter

Simple product rangeThere is a solution for any configuration

Site

Site

DatacenterMobile Site

Hardware

Fits to any size

v4 - Hardware Product Range

MobileSite

10

Site

20

Datacenter

10

Datacenter

20

Datacenter

30

Datacenter

40

Datastore or Capture Datastore

Datastore

or

Capture

MobileSite

10

Site

20

Datacenter

10

Datacenter

20

Datacenter

30

Datacenter

40

Sizing

Flow Analyses

Per Minute

50 K 100 K 250 K 500 K 1 MStill in

Benchmark

Still in

Benchmark

Vendor Limit 75 K 150 K 375 K 650 K 1,25 M TBD TBD

Data Storage ~ 1 TiB 1,9 TiB 3,8 TiB 5,7 TiB 7,6 TiB 11,5 TiB 15 TiB

Default

Network Interfaces

2x1Gb

[ Wifi - Later]8x1Gb 6x1Gb + 2x10Gb 6x1Gb + 2x10Gb 6x1Gb + 2x10Gb 6x1Gb + 2x10Gb 6x1Gb + 2x10Gb

Chassis Mobile 1U 1U 2U 2U 2U 2U

v4 - Hardware Product Range

Options MobileSite

10

Site

20

Datacenter

10

Datacenter

20

Datacenter

30

Datacenter

40

Data Redundancy

(RAID 10)-

4 x 1 Gbps Copper -

2 x 10 Gbps Fiber - Capture Only

2 x 10 Gbps Fiber

2 x 1 Gbps Copper- Capture Only

4 x 10 Gbps Fiber - -

2 x 40 Gbps Fiber - -

v4 - Hardware Product Range: Options

1

2

3

4

5

6

7

8

9

10

11

12 Flow analysis per minute

New market opportunities

Get data faster!

Extend your business to new areas

New opportunities

TBD

TBD

Virtual

Fits to any size

DatacenterExpress Site

Express VS FullFeature comparison

Data history limited to 15 days

No distributed architecture

No automated reporting

No SNMP API

Express?

Virtual

Fits to any size

Express Small Large

20K 250K

SiteSite

Small

Site

Medium

Site

XLarge

Site

Large

20 K 50 K 100 K 250 K

DC

XXLarge

DC

Small

DC

Large

DC

Medium

DC

XLarge

500 K 750 K 1 M TBD TBD

Datacenter

Flow analysis / minute

Flow analysis / minute

Flow analysis / minute

ELA: Enterprise License AgreementFor Virtual Environments

Express Small Large

ELA Credits 1 2

Site Small Medium Large XLarge

ELA Credits 2 3 4 6

Datacenter Small Medium Large XLarge XXLarge

ELA Credits 8 10 12 TBD TDB

Capture 15 Pack for Intra VM

Capture

10 Pack for Intra VM

Capture

20 Pack for Intra VM

Capture

ELA Credits 1 3 5 8

1

2

3

4

5

6

7

8

9

10

11 Flow analysis per minute

v3 limit

Get data faster!

Extend your business to new areas

New opportunities

New market opportunities

TBD

TBD

Virtual appliances will require more resources to achieve this level of

performances

Processor

Memory

Storage

Requirements

Impact

DB2 database

New data retention strategy

New metric

VXLAN for SDN

VMWare vSphere 6

And more…

More Features?

Database

Performance Analysis

Oracle SQL Server PostgreSQL MySQL DB2

DB2 SupportFull Layer 7 SQL transaction analysis

Target large companies

• Finance & Insurance

• Travel & Logistics

• Public Sector

Simplified data

retention strategy

Level 1

Max Details

1 minute

Level 2

Medium Details

1 hour

Level 3

Low Details

1 day

History depth depends on storage capacity (automatic adjustment)

Maximum details level potentially massively extended

Data History Flexibility

Search optionChoose between time and details

Client Port

Now keeps Client Port of conversations,

with sorting and filtering possibilities

VoIP The Mean Opinion Score (MOS) is now estimated even without control (RTCP) flows

VoIP: Improved MOS computation

Select the number of elements

displayed in data tables

Virtual Extensible LAN (VXLAN, IETF, RFC 7348)

Encapsulate a layer 2 network on top of layer 3

to create a logical network for your virtual machines across different networks

VXLAN SupportSDN

Ready

Support for version 6

Asymmetric conversations:

VLAN and Interface information can be preserved

Sniffer Configuration

Client IP Server IP VLAN SRT

192.168.10.1 192.168.20.2 10 n/a

192.168.20.2 192.168.10.1 20 n/a

Two unilateral conversations

Client IP

192.168.10.1

Server IP

192.168.20.23.2 ms

VLAN 10

VLAN 20

Client IP

192.168.10.1

Server IP

192.168.20.23.2 ms

VLAN 10

VLAN 20

Client IP Server IP VLAN SRT

192.168.10.1 192.168.20.2 Merged 3.2 ms

SRT is computed

No VLAN information

Client IP

192.168.10.1

Server IP

192.168.20.23.2 ms

VLAN 10

VLAN 20

Client IP Server IP Client VLAN Server VLAN SRT

192.168.10.1 192.168.20.2 10 20 3.2 ms

SRT is computed

VLAN displayed for both Client & Server

Same principle applies to Network interfaces

TCP EventsAdd or remove columns to display

Reset

Fin

End

Timeout

DupAck

Source Destination

Displayed both directions

New look & feel

3.3 4.0

Improved readability

Licenses Migration NPS: no migration to v4

Before After

Migration not supported

Migration not supported

Migration not supported

NPS Express

NPP Poller

NPS

NPS

NPP Poller

NPS Express

Licenses Migration For old APS Licenses (<3.X)

Before After

Even for v3 hardware appliances

APS Small

APS Medium or Large

APS Express

APS Full

Site Small

Site Medium

Express Small

Site XLarge

Licenses Migration For old APS Licenses (>=3.X)

Express Small

Express Large

Free

Express Small

Express Large

Free

Before After

Licenses Migration For old APS Licenses (>=3.X)

Full Medium

Full Large

Full Small

Site Medium

Site XLarge

Site Small

Before After

Even for v3 hardware appliances

Licenses Migration Poller (v3) becomes Capture (v4)

Before After

CapturePoller (APP)

Configuration and Data MigrationWarning: all existing data will be lost!

Configuration

Users

Zones

Reports

Configuration

Preserved

Preserved

Preserved (check custom filters, if any)

Before After

Data All data is lost during migration!

v4 Roadmap

2016 End of January

AvailabilityPerformance Vision v4

What’s Next?

Performance Vision

Scalability

Limit?

Multi-datastore architectureUnified view across multiple databases with unlimited scalability

Datastore Datastore

Datastore Datastore

Working on Hyper-V™ support

Hyper-V

2016

2016

Q2

TBD

Microsoft Services Identification

Microsoft HyperV Support

2016Q2

Performance Vision Multi datastore architecture

FutureWhat is coming in the next releases

Performance Vision API v22016TBD

TBD

TBD

TBD

ResearchTopics with specific attention

TBD

TBD

Reworking of our User Interface

More SDN specific adjustments

TBD XenApp – Citrix transactions analysis

And more depending on customer feedback…TBD

Enjoy!

www.securactive.netThank You!

Thank You!

For any Question

sales@securactive.net

support@securactive.net